{
    "CVE_data_meta": {
        "ASSIGNER": "security@ubuntu.com",
        "ID": "CVE-2021-4120",
        "STATE": "PUBLIC",
        "TITLE": "snapd could be made to bypass intended access restrictions through snap content interfaces and layout paths"
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "product": {
                        "product_data": [
                            {
                                "product_name": "snapd",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<=",
                                            "version_value": "2.54.2"
                                        }
                                    ]
                                }
                            }
                        ]
                    },
                    "vendor_name": "Canonical Ltd."
                }
            ]
        }
    },
    "credit": [
        {
            "lang": "eng",
            "value": "Ian Johnson"
        }
    ],
    "data_format": "MITRE",
    "data_type": "CVE",
    "data_version": "4.0",
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1"
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.0.9"
    },
    "impact": {
        "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
        }
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-20 Improper Input Validation"
                    }
                ]
            }
        ]
    },
    "references": {
        "reference_data": [
            {
                "refsource": "MISC",
                "url": "https://ubuntu.com/security/notices/USN-5292-1",
                "name": "https://ubuntu.com/security/notices/USN-5292-1"
            },
            {
                "refsource": "MISC",
                "url": "https://bugs.launchpad.net/snapd/+bug/1949368",
                "name": "https://bugs.launchpad.net/snapd/+bug/1949368"
            },
            {
                "refsource": "MLIST",
                "name": "[oss-security] 20220218 CVE-2021-4120: Insufficient validation of snap content interface and layout paths",
                "url": "http://www.openwall.com/lists/oss-security/2022/02/18/2"
            },
            {
                "refsource": "FEDORA",
                "name": "FEDORA-2022-82bea71e5a",
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QTBN7LLZISXIA4KU4UKDR27Q5PXDS2U/"
            },
            {
                "refsource": "FEDORA",
                "name": "FEDORA-2022-5df8b52ba4",
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XCGHG6LJAVJJ72TMART6A7N4Z6MSTGI7/"
            }
        ]
    },
    "source": {
        "defect": [
            "https://launchpad.net/bugs/1949368"
        ],
        "discovery": "INTERNAL"
    }
}